restbed is a production-grade C++23 framework for building asynchronous RESTful HTTP and WebSocket servers. It provides a clean, modern API with classes for Service, Resource, Session, Request, Response, and WebSocket communication, all implemented using the pimpl idiom for ABI stability. The framework handles HTTP/1.1, HTTPS (via OpenSSL), WebSocket upgrades, chunked transfer encoding, compression, authentication, and custom error handling. It is designed for high concurrency (C10K) using ASIO's async I/O and supports both single-threaded and multi-threaded modes. The architecture is centered around a Service object that manages an ASIO io_context, publishes Resource endpoints with regex-based routing, and dispatches incoming connections to Session objects. Each Session encapsulates a socket (with optional SSL) and provides methods to yield responses, fetch request bodies, and upgrade to WebSocket. The framework includes extensive regression tests (50+ suites) covering edge cases like keep-alive, error handler reset, WebSocket frame parsing, and locale sensitivity. Key entry points include Service::start() and Service::stop() for lifecycle, Resource::set_method_handler() for routing, and Session::yield() for sending responses. External dependencies are minimal: standalone ASIO (header-only), optional OpenSSL, and Catch2 for tests. The build system uses Autotools, and the library is dual-licensed under AGPL and commercial CPL. Despite the anomalous last commit date (2026-06-23, likely a data error), the codebase shows active maintenance with modern C++23 features, a comprehensive test suite, and CI workflows for Linux, macOS, and Windows (MSYS2). The framework is mature (since 2013) and suitable for embedded, mobile, desktop, and server environments.
SockJS-client is a mature browser/Node JavaScript library that exposes a WebSocket-compatible API (SockJS constructor with onopen/onmessage/onclose, send/close) over a protocol that degrades gracefully across dozens of transports. In production it first tries native WebSockets, then falls back through xhr-streaming, xdr-streaming, eventsource, htmlfile, xhr-polling, xdr-polling, iframe-mediated variants, and jsonp-polling. The connection flow is: validate the URL against the HTML5 WebSocket constructor spec, fetch the server's /info endpoint to measure RTT and capability flags (cookie_needed, websocket support, base_url), compute a dynamic RFC 2988-style retransmission timeout, then walk an ordered transport list with per-transport round-trip timeouts until one opens. Incoming frames are type-prefixed ('o' open, 'h' heartbeat, 'a' batched messages, 'm' message, 'c' close); outgoing messages are JSON-array framed with aggressive Unicode escaping. Architecturally it is a modular CommonJS library bundled with browserify into a UMD global (dist/sockjs.js) plus a newer ESM build (dist/sockjs-esm.js) and handwritten TypeScript declarations. lib/main.js is the core state machine; each transport is split into senders (xhr-cors, xhr-local, xdr, jsonp) and receivers (incremental XHR streaming parser, eventsource, htmlfile, jsonp) composed by shared glue in lib/transport/lib (ajax-based, sender-receiver, buffered-sender, polling). A DOM2-style EventTarget/EventEmitter layer provides addEventListener and on* semantics. Browser versus Node differences are resolved via package.json 'browser' field remapping: faye-websocket <-> native WebSocket, eventsource package <-> global EventSource, Node crypto <-> window.crypto. Because the library must support IE6-9 era browsers, the source is deliberately ES5 with vendored es5-shim pieces. The engineering craftsmanship is genuine: the XHR receiver tracks a persistent buffer offset so streaming readyState=3 chunks are parsed incrementally without re-scanning; lib/utils/escape.js lazily unrolls a 65,536-character lookup table only when a message contains characters that browsers mangle on the wire; the JSONP receiver handles IE9's onerror/onreadystatechange race with a loadedOkay flag and the htmlFor/onclick script-execution trick; iframe transports enforce postMessage origin equality and window-ID correlation; unload/pagehide lifecycle hooks clean up sockets and iframes. The Node WebSocket transport propagates real backpressure (send() returning false plus a drain event) and the test suite proves it against an actual faye-websocket socket. Maintenance is low-velocity but real: the last commit is recent, CI runs Node 18/20/22, and the 1.6.x history is dominated by CVE-driven dependency bumps (url-parse, eventsource, minimist, faye-websocket) plus the 1.6.2 ESM/types addition. Drift is medium: the gulp+browserify build chain is dated, .nvmrc pins Node 12 while CI tests 18/20/22, lib/version.js lags package.json (1.6.1 vs 1.6.2), and several TODO comments remain. None of this affects the library's contract; it is still the de-facto SockJS client and remains safe to depend on.